MechanismArticle

Anthropic's web_fetch tool defends against exfiltration by only allowing navigation to exact URLs the user typed or that came back from web_search.

The core protection rule: web_fetch can only visit URLs the user explicitly entered or that were returned by web_search, blocking simple exfiltration instructions. ✦ AI generated

Simon Willison · Simon Willison's Weblog · 2026-07-15 · original ↗

Share card ↓Export .md Export .txt

Anthropic's protection is that web_fetch can only be used to navigate to exact URLs that the user has entered themselves or that were returned from its companion web_search tool.

Read full article ↗excerpt · fair-use quotation

▦ Anthropic ✳ web_fetch

Around this claim

Counterpoint · 2

web_fetch's rule allowing it to follow links embedded within previously fetched pages created a loophole for a honeypot site to chain nested links and exfiltrate data.Ayush Paul · Simon Willison's Weblog · conf 75%The attack succeeded in extracting the user's name, home city, and employer name.Simon Willison · Simon Willison's Weblog · conf 68%

This moment responds to

provides context → Server-side tools for WebSearch, WebFetch, CodeExecution, and AnthropicMCP are now available through LLM's -T interface or Python tools=, replacing the previous -o web_search* options.llm-anthropic maintainer · Simon Willison's Weblog